Kaspersky Urges Malaysian Organisations to Know Their Enemy Through Threat Intelligence

Sun Tzu wrote that someone who knows both the enemy and themselves "need not fear the results of a hundred battles". Kaspersky borrowed that idea for a session with the Malaysian media on why businesses need to understand the specific threats aimed at them.

The pandemic sped up digital transformation around the world. As more industries move their operations online, criminals have found ways in, putting organisational data at risk and causing losses. The damage after an attack can be severe, and full recovery often costs companies a great deal of money.

Kaspersky's view is that relying on defence alone against incoming threats is no longer realistic. Organisations should look for ways to take the offensive in their security, and that starts with knowing which threats they face during the current crisis.

Three kinds of attacker

The session sorted threats into three groups. APT groups are well-funded outfits that mount advanced attacks on particular organisations to achieve a goal; this category also covers politically motivated cyber mercenaries and criminals who go after the industrial sector. FIN groups are driven by money and steal data to profit from it. During the pandemic they moved beyond their usual targets and began attacking organisations outside finance. The third group is opportunistic attackers, who rely on ransomware, remote access Trojans (RATs), stealers and crypto miners.

Threat intelligence has become a much discussed subject in security. Knowing which threats a particular organisation is likely to face helps it avoid serious consequences if an attack comes. Working out which groups or actors might want to target it also shows an organisation what infrastructure it needs to protect its data, which is how defence becomes offence.

What threat intelligence is meant to do

Victor Chu, Kaspersky's Head of Systems Engineering for Southeast Asia, said the purpose of cyber intelligence is to help organisations build a proactive defensive posture while feeding into decisions across the whole organisation that lower cyber risk. He listed five elements that make up threat intelligence: age, application, context and attributions, relevance, and kill chains.

Chu said Kaspersky holds a wide range of information that it can translate into a picture of how adversaries behave. With that picture, he explained, the company can help organisations with differing goals add an offensive element to the defensive mechanisms protecting their networks.

Kaspersky Threat Intelligence currently offers the following services:

• Threat Data Feeds
• CyberTrace
• APT Intelligence Reporting
• Financial Threat Intelligence Reporting
• Digital Footprint Intelligence
• Threat Lookup
• Cloud Sandbox
• ICS Reporting

The company has also examined how the growth in digital money transactions in Malaysia creates risks for financial institutions and their customers, and it set out in a separate press release how organisations can strengthen their threat intelligence.